Describe the bug
@sveltejs/adapter-cloudflare generates an _headers rule that applies Cache-Control: public, immutable, max-age=31536000 to every /_app/immutable/* request, including missing files.
This can permanently cache a 404 in the browser when an existing SvelteKit client requests an old dynamically imported chunk after a deployment, or a new file that is currently being deployed. Subsequent reloads continue failing with Failed to fetch dynamically imported module until the browser cache is explicitly bypassed or cleared.
A non-success response should instead use no-store or max-age=0, must-revalidate. Successful fingerprinted assets can remain immutable.
This affected a production Android user in both an installed PWA and Chrome. Normal refreshes and the application’s retry button did not recover because Chrome continued using the cached failure.
The only successful recovery was enabling USB debugging, opening the mobile page through desktop Chrome remote DevTools, enabling Disable cache, and refreshing. This is not a practical recovery procedure for normal users.
Reproduction
curl -I https://example.com/_app/immutable/does-not-exist.js
Actual response:
HTTP/2 404
Cache-Control: public, immutable, max-age=31536000
Logs
System Info
@sveltejs/adapter-cloudflare: 7.2.9
@sveltejs/kit: 2.70.1
wrangler: 4.114.0
Cloudflare Workers Static Assets
Severity
annoyance
Additional Information
Similar to #16071
Describe the bug
@sveltejs/adapter-cloudflare generates an _headers rule that applies Cache-Control: public, immutable, max-age=31536000 to every /_app/immutable/* request, including missing files.
This can permanently cache a 404 in the browser when an existing SvelteKit client requests an old dynamically imported chunk after a deployment, or a new file that is currently being deployed. Subsequent reloads continue failing with Failed to fetch dynamically imported module until the browser cache is explicitly bypassed or cleared.
A non-success response should instead use no-store or max-age=0, must-revalidate. Successful fingerprinted assets can remain immutable.
This affected a production Android user in both an installed PWA and Chrome. Normal refreshes and the application’s retry button did not recover because Chrome continued using the cached failure.
The only successful recovery was enabling USB debugging, opening the mobile page through desktop Chrome remote DevTools, enabling Disable cache, and refreshing. This is not a practical recovery procedure for normal users.
Reproduction
Actual response:
Logs
System Info
Severity
annoyance
Additional Information
Similar to #16071